Visao

Visao is a static analyser. It reads nineteen languages: C, C++, Go, Python, Rust, JavaScript, TypeScript, Java, Kotlin, C#, Ruby, PHP, Swift, Lua, Delphi, assembly, CMake, Bash and YAML. A language-agnostic Semantic Hypervisor lowers each input to one intermediate representation. The hypervisor then drives a set of abstract-interpretation domains, which include the interval, octagon, pointer, resource-state and set domains. The SMT back-ends Z3 and CVC5 answer the questions that the domains leave open.

Each rule exists one time, and it holds for every language. Each front-end supplies types, control flow and the vocabulary of its ecosystem. The analysis above the front-ends is shared.

Visao also lists Suspicious places. These are the places in a change that a reviewer must read first. Visao classifies each place and prints it with its code.

Two run modes

Console mode

One-shot command. Give it the files, or one compile_commands.json. It prints the reports and exits.

Server mode

Long-lived server. A client queries it with the Analysis Server Protocol over NNG REQ/REP. The server runs on an in-tree actor framework. The architecture section of that page gives the details.

Highlights

More than one platform

Visao runs on Linux, on macOS and on Windows.

Cross-compilation

--compiler-path registers any GCC-like toolchain beside the host toolchain. A cache pays for the probe one time.

The build that you have

Give Visao your compile_commands.json file as the only input.

A clear command line

Visao prints colour-coded reports, dimmed engine messages and a final status on one line. It obeys NO_COLOR and the --color flag. CLI reference lists every flag.

Embeddable

The libasp library of the Analysis Server Protocol gives another tool typed access to the analyser.

Where to start

New to Visao

Read Getting started.

Your language

Read Languages. It states the file names of each language and what the analysis gives you.

The meaning of a finding

Read the page of its rule in the catalogue at https://defectdb.org.

The full list of flags

Read CLI reference.

Privacy

Visao analyses your code on your machine. It sends nothing anywhere, and it uses no service of a third party. Privacy policy states what the analyser reports and what it writes to disk.

License

Use of Visao needs a commercial license. Contact Interpretica through the form at https://interpretica.io, or write to sales@interpretica.io.